Privacy Analysis of Oblivious DNS over HTTPS: a Website Fingerprinting Study

As our digital presence expands, safeguarding private data and preserving online privacy becomes paramount. Thus, motivating the development of secure DNS systems, such as DNS over TLS or HTTPS. The vulnerability of these protocols against privacy attacks has led to the development of the Oblivious DNS-over-HTTPS (ODoH) protocol. Nevertheless, the extent of ODoH’s effectiveness in protecting clients’ privacy is still unknown. This study investigates ODoH resiliency against website fingerprinting attacks in the open-world setting. We deploy an ODoH testbed on GENI for data collection and employ deep learning techniques such as ensemble learning for data analysis. Our findings reveal that a passive adversary can identify targeted websites using ODoH traces with an accuracy of 94%. Additionally, we analyze the impact of various factors, including clients’ locations, available resolvers, and time stability, on the attack’s success. Finally, we prototype a mitigation strategy and demonstrate its effectiveness in safeguarding clients privacy.